Description
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php.
Remediation
References
Related Vulnerabilities
WordPress Plugin MStore API-Create Native Android & iOS Apps On The Cloud Security Bypass (2.1.5)
Internet Information Services Other Vulnerability (CVE-2002-1908)
WordPress Plugin Import any XML or CSV File to WordPress Multiple Vulnerabilities (3.2.4)